CVE-2014-0502

After analyzing public vulnerabilities and exploit trends in the first half of 2014, Bromium Labs concluded that Internet Explorer is the “sweet spot for attackers.” “Internet Explorer was the most patched and also one of the most exploited products,” the report (pdf) states. Microsoft’s browser “set a record high for reported vulnerabilities in the first […]

Attackers are targeting vulnerabilities in major Web browsers to compromise cloud-based point-of-sale (PoS) systems, according to cyber threat intelligence firm, IntelCrawler. The malware, called POSCLOUD by IntelCrawler, targets cloud-based PoS software commonly used by grocery stores, retailers, and other small businesses, the company wrote in a report released Wednesday. Unlike most PoS malware, POSCLOUD doesn’t bother with RAM scraping to intercept payment card information before the system gets a chance to encrypt the data. Instead, the malware relies on keylogging and stealth screenshots to steal personal information and financial data, which are then sold on underground forums to identity thieves, IntelCrawler said. Researchers initially uncovered the malware after a big botnet takedown, said Andrew Komarov, CEO of IntelCrawler. Many of these cloud systems integrate with locally-attached hardware such as credit card readers, barcode scanners, cash drawers, and receipt printer a…

Experts at Symantec have discovered that behind the Elderwood Platform there is a still active group which is providing Zero-Day exploit used recently. Do you remember the Elderwood project? It was September 2012 when Symantec security firm published an analysis that demonstrate the link between a series of cyber attacks against more than 30 companies and the cyber […]

Further investigation into an exploit kit known as “Elderwood” shows the attackers using it are more numerous and possibly better funded than previously thought, according to new research from Symantec. Elderwood is a hacking platform that has attack code which abuses software vulnerabilities in programs such as Adobe Systems’ Flash multimedia program and Microsoft’s Internet […]

Researchers at Symantec say the Elderwood attack platform is at the center of numerous zero-day attacks launched by hacker crews around the world this year.

Here’s an overview of some of last week’s most interesting news, reviews, articles and interviews: (IN)SECURE Magazine issue 41 released (IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Issue 41 has been released today. Exploring the complexity of modern cyber attacks James Holley is an Executive Director at Ernst & Young LLP. In this interview he discusses the complexity of modern cyber attacks, the challenges involved in … More →

Adobe released their second out-of-band update for Adobe Flash this month. APSB14-07 fixes three vulnerabilities in Adobe Flash, including CVE-2014-0502 which is being used in the wild to attack users through malicious webpages. The 0-day flaw in Flash CVE-2014-0502 was discovered about a week ago by FireEye which states that it was found on three websites that are run by non-profit institutions. Fortunately organizations that are running latest operating systems and application code are not … More →

Adobe Systems issued critical security updates today to address vulnerabilities in Adobe Flash Player – including one vulnerability that is under attack.

Update (02/24/14): This exploit has been found in the wild already. It is blocked by Malwarebytes Anti-Exploit.In a very busy month for…